Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-87121 | critical | 9.8 | No | lwIP TCP/IP Stack MQTT is vulnerable to an out-of-bounds write, which may allow an attacker to gain full code execution on the device. | 2026-09-23 |
| CVE-2026-96456 | medium | 6.3 | No | The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not... | 2026-09-23 |
| CVE-2026-96455 | high | 8.8 | No | The Reachy Mini daemon exposes an HTTP API for managing the robot. Its app installation endpoint, POST /apps/install in src/reachy_mini/daem... | 2026-09-23 |
| CVE-2026-96454 | high | 8.2 | No | Pake turns a website into a desktop application built on Tauri. Every application it generates inherits two settings from the upstream templ... | 2026-09-23 |
| CVE-2026-95627 | high | 7.7 | No | When a Tauri application uses the dialog plugin's file or folder picker, an attacker with JavaScript execution (XSS) can force the scope exp... | 2026-09-23 |
| CVE-2026-95626 | high | 8.3 | No | Tauri's Content Security Policy hardening, which injects a random nonce to restrict script execution, provides zero protection when an appli... | 2026-09-23 |
| CVE-2026-95625 | medium | 5.9 | No | The Tauri updater plugin verifies update binaries using minisign signatures, but the signature covers only the raw binary bytes. The update... | 2026-09-23 |
| CVE-2026-28664 | high | 7.8 | No | In WriteImageToDisk of runtime_image.cc, there is a possible file tampering due to a logic error in the code. This could lead to local escal... | 2026-09-23 |
| CVE-2026-6669 | medium | 5.9 | No | Missing upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server in PgBouncer through 1.25... | 2026-09-23 |
| CVE-2026-6668 | high | 7.5 | No | Integer overflow in the packet buffer growth logic in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to cause a denial o... | 2026-09-23 |
| CVE-2026-19888 | high | 7.5 | No | Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated r... | 2026-09-23 |
| CVE-2026-96548 | medium | 5.6 | No | A flaw has been found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This affects an unknown part of the file ssm_pr... | 2026-09-23 |
| CVE-2026-95604 | high | 7.5 | No | Unauthenticated Broken Access Control in Loops & Logic <= 4.2.4 versions. | 2026-09-23 |
| CVE-2026-95602 | medium | 6.5 | No | Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Config... | 2026-09-23 |
| CVE-2026-95601 | critical | 9.3 | No | Unauthenticated SQL Injection in Product Filter by WBW <= 3.1.7 versions. | 2026-09-23 |
| CVE-2026-95593 | high | 7.6 | No | Editor SQL Injection in Ultimeter <= 3.0.8 versions. | 2026-09-23 |
| CVE-2026-95590 | high | 7.1 | No | Subscriber SQL Injection in Tainacan <= 1.2.0 versions. | 2026-09-23 |
| CVE-2026-95586 | medium | 6.5 | No | Contributor Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <= 3.5.50 versions. | 2026-09-23 |
| CVE-2026-95529 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Calculated Fields Form <= 5.5.1.1 versions. | 2026-09-23 |
| CVE-2026-95527 | medium | 6.5 | No | Unauthenticated Broken Access Control in Conekta Payment Gateway <= 6.2.4 versions. | 2026-09-23 |